539dcdfc64c240c25fbc62a4e6e7e342 | Triage

Sharing

General

Target

539dcdfc64c240c25fbc62a4e6e7e342
Size

3.7MB
MD5

539dcdfc64c240c25fbc62a4e6e7e342
SHA1

423ae48b159283481c5d4bf68a1907a3694163a2
SHA256

8be8ad59d3759c835d2783c50628bed7a5afad65a488ee929d48de3083a8318f
SHA512

ec2bfc5d36caffe40177aad5671a5dfef453c537e2cfbb1838e32bfe67f0d31db21b01fb4e67ef813d0cd226341bda1e1087b0d7d1c10b933212f4bc6f8f084e
SSDEEP

98304:PiSG/g3bDWOn6hOiiy+xqeBOjPuzZ1DzBIVFJ:q//gLDWOwOiifxqeBO7Uv6FJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
539dcdfc64c240c25fbc62a4e6e7e342

Files

539dcdfc64c240c25fbc62a4e6e7e342
.exe windows:4 windows x86 arch:x86

5a86c1e919d1db491ea4db40518bb0dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA
DdeCmpStringHandles

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

wininet

InternetGetConnectedState

Sections

.text
Size: 45KB - Virtual size: 17.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE